{"api_version":"1","generated_at":"2026-07-23T06:10:44+00:00","cve":"CVE-2008-6637","urls":{"html":"https://cve.report/CVE-2008-6637","api":"https://cve.report/api/cve/CVE-2008-6637.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-6637","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-6637"},"summary":{"title":"CVE-2008-6637","description":"Multiple cross-site scripting (XSS) vulnerabilities in forgotPW.php in Library Video Company SAFARI Montage 3.1.x allow remote attackers to inject arbitrary web script or HTML via the (1) school and (2) email parameters.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-04-07 14:17:17","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42598","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42598","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/1652","name":"http://www.vupen.com/english/advisories/2008/1652","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.digitrustgroup.com/advisories/web-application-security-safari-montage.html","name":"http://www.digitrustgroup.com/advisories/web-application-security-safari-montage.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"The DigiTrust Group: Advisory #080519a - Safari Montage Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/45646","name":"http://osvdb.org/45646","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/30363","name":"http://secunia.com/advisories/30363","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29343","name":"http://www.securityfocus.com/bid/29343","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"SAFARI Montage 'forgotPW.php' Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-6637","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-6637","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"6637","vulnerable":"1","versionEndIncluding":"3.1.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"libraryvideocompany","cpe5":"safari_montage","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T11:34:47.250Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"29343","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29343"},{"name":"safarimontage-forgotpw-xss(42598)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42598"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.digitrustgroup.com/advisories/web-application-security-safari-montage.html"},{"name":"45646","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/45646"},{"name":"ADV-2008-1652","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/1652"},{"name":"30363","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30363"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-05-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in forgotPW.php in Library Video Company SAFARI Montage 3.1.x allow remote attackers to inject arbitrary web script or HTML via the (1) school and (2) email parameters."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"29343","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29343"},{"name":"safarimontage-forgotpw-xss(42598)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42598"},{"tags":["x_refsource_MISC"],"url":"http://www.digitrustgroup.com/advisories/web-application-security-safari-montage.html"},{"name":"45646","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/45646"},{"name":"ADV-2008-1652","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/1652"},{"name":"30363","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30363"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-6637","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in forgotPW.php in Library Video Company SAFARI Montage 3.1.x allow remote attackers to inject arbitrary web script or HTML via the (1) school and (2) email parameters."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"29343","refsource":"BID","url":"http://www.securityfocus.com/bid/29343"},{"name":"safarimontage-forgotpw-xss(42598)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42598"},{"name":"http://www.digitrustgroup.com/advisories/web-application-security-safari-montage.html","refsource":"MISC","url":"http://www.digitrustgroup.com/advisories/web-application-security-safari-montage.html"},{"name":"45646","refsource":"OSVDB","url":"http://osvdb.org/45646"},{"name":"ADV-2008-1652","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/1652"},{"name":"30363","refsource":"SECUNIA","url":"http://secunia.com/advisories/30363"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-6637","datePublished":"2009-04-07T10:00:00.000Z","dateReserved":"2009-04-06T00:00:00.000Z","dateUpdated":"2024-08-07T11:34:47.250Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-04-07 14:17:17","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:libraryvideocompany:safari_montage:*:*:*:*:*:*:*:*","versionEndIncluding":"3.1.3","matchCriteriaId":"4B5BE280-34BA-40BA-8670-7A3542DC8B8F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"6637","Ordinal":"1","Title":"CVE-2008-6637","CVE":"CVE-2008-6637","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"6637","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in forgotPW.php in Library Video Company SAFARI Montage 3.1.x allow remote attackers to inject arbitrary web script or HTML via the (1) school and (2) email parameters.","Type":"Description","Title":"CVE-2008-6637"},{"CveYear":"2008","CveId":"6637","Ordinal":"2","NoteData":"2009-04-07","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"6637","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}